Description

The contract implementation contains faulty pause logic.

• The _update function in USPC does not have whenNotPaused modifier.

• Price reading functions (e.g., getLatestPrice) are protected by whenNotPaused modifier, but price management functions (addPrice, updatePrice) are not.

• The processRedemptions function applies only the global whenNotPaused modifier. However, the validation for the redemptionPaused flag has been omitted.

Impact

This incorrect logic renders the pause mechanism ineffective, resulting in a loss of control in emergency scenarios.

Recommendations

We recommend to add missing whenNotPaused modifier and redemptionPaused check.

Remediation

This issue has been acknowledged by Coinshift, and a fix was implemented in commit d14d8915↗.